# DF-0075 — DIOCGSLICEINFO kernel pointer leak

## Verdict: REPRODUCED (info leak of kernel KVA pointers)

`subr_diskslice.c:556-559` services `DIOCGSLICEINFO` with a raw
`bcopy(ssp, data, ...)` of the in-kernel `struct diskslices` (header +
active `struct diskslice`s).  That struct embeds several kernel virtual
addresses that are copied out verbatim to userspace:

- `diskslices.dss_cdevsw`  — `struct cdevsw *`   (declared but, in current
  master, never assigned, so observed NULL)
- `diskslice.ds_dev`       — `cdev_t`            [diskslice.h:144]
- `diskslice.ds_label`     — `disklabel_t.opaque` (kmalloc'd label) [diskslice.h:155]
- `diskslice.ds_ops`       — `struct disklabel_ops *` (static kernel .data) [diskslice.h:156]
- `diskslice.ds_devs[]`    — `void *[]`           [diskslice.h:158]

## Reproduction

On the audit guest (`/dev/vbd0`, the labeled root disk), three kernel
addresses are leaked deterministically (3/3 runs identical):

```
[+0x220] 0xfffff8008da2fc00   <- ds_dev        (cdev_t, kernel heap)
[+0x268] 0xfffff8008edb5080   <- ds_label.opaque (kmalloc'd disklabel)
[+0x270] 0xffffffff810e0a40   <- ds_ops        == disklabel64_ops (nm-verified)
```

`0xffffffff810e0a40` matches `disklabel64_ops` from `nm /boot/kernel/kernel`
exactly, making the leak unambiguous: a **static kernel `.data` symbol** is
returned to userland on every `DIOCGSLICEINFO` call.

```
ssh dfbsd 'cd /home/maxx/poc/DF-0075 && ./poc_df0075'
```

## Realistic reachability / impact ceiling

The raw disk nodes on this guest are `root:operator crw-r-----`; the
unprivileged `maxx` user (not in `operator`) cannot open them, so the
unprivileged reachability requires `operator`-group membership — a realistic
storage/backup-admin precondition but not the strict default.  Demonstrated
as root.  Impact is a **KASLR-bypass / kernel-pointer info leak** (not
privilege escalation): the leaked `.data`/heap addresses defeat KVA
randomization and would ease exploitation of a separate memory-corruption
bug (e.g. DF-0074, same ioctl).  No memory-corruption primitive is
introduced by this bug itself.

## Fix

`fix.diff` copies the struct out as before, then sanitizes every
kernel-pointer field in the destination buffer (`dss_cdevsw`, per-slice
`ds_dev`, `ds_label.opaque`, `ds_ops`, `ds_devs[]`) before return.  Validated
on a built single-fix kernel: baseline leaks 3 pointers (incl.
`disklabel64_ops`); patched kernel leaks **0**.